{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"c6bf9060466c41a0688cd4070086732fa6e4b4ac811676c132217c4f391c80bf","tlsh":"c8d0978a84d73d605800c7ad1db3a0808a19e105cf0cd9feb2cc0f842745c2a0f240bd"}],"package_integrity":[{"filename":"hijiko_pilaka-1.0.0.tar.gz","hashes":{"blake2b_256":"65085266bb3562b9a945409ff9f84f30c3ff5767689bed34d83cbcdf5090d250","md5":"cc150c9c51f4c87de6f226fdfdc58ccf","sha256":"0763e8a45cb4760a247b36b5ba378823419f82c7f64b40671e1ea4c494fed8dd"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hijiko-pilaka/MAL-2026-18111.json"},"package":{"ecosystem":"PyPI","name":"hijiko-pilaka","purl":"pkg:pypi/hijiko-pilaka"},"versions":["1.0.0"]}],"credits":[{"contact":["inspector-research@amazon.com"],"name":"Amazon Inspector","type":"FINDER"},{"contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"name":"Kamil Mańkowski (kam193)","type":"REPORTER"}],"database_specific":{"iocs":{"domains":["artifacts.vacsdk.com","vacsdk.com","artifacts.yosiroute.com"]},"malicious-packages-origins":[{"id":"pypi/2026-10-vacsdk/hijiko-pilaka","import_time":"2026-10-20T21:40:17.573565401Z","modified_time":"2026-10-20T20:50:18.075939Z","sha256":"1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d","source":"kam193","versions":["1.0.0"]},{"id":"IN-MAL-2026-021863","import_time":"2026-10-29T13:37:13.814804274Z","modified_time":"2026-10-29T13:17:57Z","sha256":"618fc4257600bc10efdde21aaa2bfe35b4e2138a4c2ea6997c4e1b0daac4b55b","source":"amazon-inspector","versions":["1.0.0"]},{"id":"pypi/2026-10-vacsdk/hijiko-pilaka","import_time":"2026-11-03T21:11:41.886423913Z","modified_time":"2026-10-20T20:50:18.075939Z","sha256":"7e67ec09bd5789dde87255688e6b0b8c4d1357ba839a44999e2924cb5ba8f39c","source":"kam193","versions":["1.0.0"]}]},"details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (618fc4257600bc10efdde21aaa2bfe35b4e2138a4c2ea6997c4e1b0daac4b55b)\nhijiko-pilaka 1.0.0's setup.py declares its only dependency, `native-delta-field-walker`, via a direct URL to a tarball on artifacts.vacsdk.com rather than a PyPI version range: `install_requires=[\"native-delta-field-walker @ https://artifacts.vacsdk.com/pypi/native_delta_field_walker-1.0.0.tar.gz\"]`. There is no hash pin or signature, so pip downloads and installs whatever bytes that URL serves at install time, executing any setup.py / build-backend / lifecycle code inside the fetched sdist. The shipped `hijiko_pilaka.py` is a 41-byte stub, so the manifest line is effectively the entire install-time surface. The host artifacts.vacsdk.com is unrelated to PyPI and is not pinned by digest, giving whoever controls that URL arbitrary code execution on any machine that runs `pip install hijiko-pilaka`.\n\n## Source: kam193 (1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d)\nThe package uses fake http-downloaded dependencies to track downloads, and has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-10-vacsdk\n\n\nReasons (based on the campaign):\n\n\n - dependency-confusion\n","id":"MAL-2026-18111","modified":"2026-11-03T21:15:03.366184678Z","published":"2026-10-20T20:50:18Z","references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/hijiko-pilaka"},{"type":"PACKAGE","url":"https://pypi.org/project/hijiko-pilaka/1.0.0/"}],"schema_version":"1.9.2","summary":"Malicious code in hijiko-pilaka (PyPI)"}